Secure computer system integrity check

Abstract

The integrity of a computer may be checked by issuing a command to read data from a hardware component of the computer and retrieving the data from a data transfer buffer. The command may be sent to a secure driver that places the central processing unit (CPU) of the computer in system management mode to trigger execution of a system management interrupt (SMI) handler. The SMI handler may read the data from the hardware component, encrypt the data, and place the encrypted data in the data transfer buffer. A system integrity check application program may read the encrypted data to determine presence of malicious code based on the data. For example, the application program may infer presence of malicious code when the encrypted data does not conform to a particular encryption algorithm or when the data does not appear in the data transfer buffer.

Description

BACKGROUND OF THE INVENTION[0001]1. Field of the Invention[0002]The present invention relates generally to computer system security, and more particularly but not exclusively to methods and apparatus for checking the system integrity of a computer.[0003]2. Description of the Background Art[0004]Computer viruses, worms, Trojans, rootkits, and spyware are examples of malicious codes that have plagued computer systems throughout the world. In the past, traditional antivirus techniques allow for detection and removal of malicious codes. However, malicious codes have become very sophisticated to the point where they can infect not just application programs but the operating system kernel and low level functionalities as well. New breeds of malicious codes can thus interfere with the operation of conventional antivirus programs, preventing malicious codes from being detected and removed. What is needed is a way to detect malicious codes, especially those that can affect low level operatio...

AI Technical Summary

Benefits of technology

This patent describes a way to check the integrity of a computer by accessing data from a hardware component and checking it for malicious code. This can be done by sending a command to a secure driver that places the computer in a special mode and reading the data from the hardware component. The data is then encrypted and placed in a separate buffer for further analysis. This process helps to identify any harmful software on a computer and helps to protect against potential security threats.

Problems solved by technology

However, malicious codes have become very sophisticated to the point where they can infect not just application programs but the operating system kernel and low level functionalities as well.

New breeds of malicious codes can thus interfere with the operation of conventional antivirus programs, preventing malicious codes from being detected and removed.

For example, the application program may infer presence of malicious code when the encrypted data does not conform to a particular encryption algorithm or when the data does not appear in the data transfer buffer.

Images